WO2005083930A1

WO2005083930A1 - Certification system in network and method thereof

Info

Publication number: WO2005083930A1
Application number: PCT/KR2005/000535
Authority: WO
Inventors: Jae Jun Lee
Original assignee: Nhn Corporation
Priority date: 2004-02-26
Filing date: 2005-02-25
Publication date: 2005-09-09
Also published as: KR100452891B1; US8504829B2; US20070055866A1

Abstract

Disclosed is a certification system of certifying a user accessing a system over a network and a method thereof. In the certification system, primary certification is performed in conjunction with a mobile communication service system based on first information provided by the user accessing the certification system through a radio network. Next, secondary certification is performed using an access server of a wired network of the certification system based on second information provided by the user. After the primary and secondary certifications are performed, linked history information on the wired network and the radio network is provided to the user. With this configuration, reliable certification for users accessing a system through a radio network can be performed, which results in a safe service.

Description

TITLE OF THE INVENTION CERTIFICATION SYSTEM IN NETWORK AND METHOD THEREOF

BACKGROUND OF THE INVENTION

(a) Field of the Invention

This invention relates to a certification system and a method thereof, and more particularly to a system of certifying a user accessing the system over a radio network and a method thereof.

(b) Description of the Related Art With the recent rapid spread of the Internet all over the world, various types of electronic commerce for the entire world through a homogeneous medium called the Internet have been developed and used. Generally, the electronic commerce includes a series of activities including commercial transactions involving movement of funds as well as customer-oriented marketing, advertising, procurement, service, contents provision, manufacture, transportation, purchases, and the like using electronic media, electronic techniques, and means under circumstances of automatic information systems integrated among enterprise-to-enterprise- enterprise-to-personal, personal-to-personal, or government-to-enterprise transactions. With the development of information and communications technologies, electronic commerce through the radio (wireless) Internet as well as the wired

Internet is being increasingly activated. Electronic commerce through the radio Internet is being even more activated with a merit that customers can acquire desired information anytime and anywhere. With the active use of the radio Internet, services enabling acquisition of information on commercial transactions on the wired Internet or personal information such as mail information through the radio Internet are being provided to customers. A user who wants to use a personal information reading service is typically required to be registered as a member in a system providing the service, and thereafter, the user can use the service only when he is certified to be the member of the system. Generally, when the user provides a user identification number (for example, an ID or the like) and a password to the system, the system may allow the user to use the service based on a determination on whether the information provided by the user is coincident with pre-stored information. However, since the user can be certified based on only the ID and password provided by the user, an unauthorized person may not be prevented from using the ID and password of the user by stealth for the purpose of using the service. Particularly in the case of charged services, pecuniary damage to the user may occur due to an illegal act of the unauthorized person.

SUMMARY OF THE INVENTION According to the present invention, user certification can be more safely performed through a network. According to the present invention, particularly, various historical information on users using services provided through different networks is mutually linked, and certification of the users using the history information is performed with safety. According to an aspect of the present invention, there is provided a certification system connected to a mobile communication service system via a network for performing certification for a user accessing the certification system through the network, the certification system including a first access server for performing an access process for the user accessing the certification system through a first network; a second access server for performing certification for the user accessing the certification system through a second network; a first certification server for performing certification for the user accessing the certification system through the first network; and a second certification server for performing certification for the user accessing the certification system through the second network. The second certification server includes a first certifying unit for acquiring first identification information and an identification number of a radio terminal of the user from the radio terminal of the user accessing the certification system through the second network, and transmitting the first identification information and the identification number to the mobile communication service system to perform primary certification, and a second certifying unit for acquiring second identification information from the radio terminal of the user and transmitting the second identification information to the first certification server to perform secondary certification. The second access server selectively provides information requested by the radio terminal of the user to the radio terminal of the user based on the second identification information of the user provided from the second certification server in conjunction with the first access server. According to another aspect of the present invention, there is provided a certification method of a certification system connected to a mobile communication service system through a network for performing certification for a user accessing the certification system through first and second networks, the method comprising a) receiving first identification information of the user and an identification number of a radio terminal of the user from the user accessing the certification system through the second network and requesting the certification system to provide a service; b) transmitting the first identification information and the identification number of the radio terminal to the mobile communication service system and requesting the mobile communication service system to perform primary certification for the user; c) receiving second identification information from the user and performing secondary certification for the user, and d) providing a service requested by user to the radio terminal of the user who accessed the certification system through the second network after the primary and secondary certifications are performed.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a structural view of a certification system in a network according to an embodiment of the present invention; FIG. 2 is a diagram illustrating an example of operation of each server in a certification process according to an embodiment of the present invention; FIGs. 3A and 3B are flow charts illustrating a certification method according to an embodiment of the present invention; FIGs. 4A and 4B are exemplary diagrams of data stored in a membership database and a first log database according to another embodiment of the present invention; and FIG. 5 is a flow chart of a certification method according to another embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREGERRED EMBODIMENTS Hereinafter, preferable embodiments of the present invention will be described in detail with reference to the accompanying drawings so that the present invention can be easily practiced by those skilled in the art. However, the present invention may be implemented in other various ways without being limited to the following embodiments. In a certification system according to an embodiment of the present invention, history information on all activities (for example, transmission/receipt of e-mail, purchase of goods, settlement of accounts, etc.) performed by a user who has accessed a system over a first network and a second network is mutually linked and provided to the user. To achieve such a mutual linkage and provision of the information, the certification includes primary and secondary certifications for the user to ensure safe user certification in conjunction with a mobile communication service system. For example, assuming the first network is a wired Internet (called "Web" here for convenience) and the second network (called "WAP (wireless application

protocol)" here for convenience), the user can access the system through the

WAP to receive the history information generated on the Web. To this end, the

certification system according to the embodiment of the present invention provides first information (for example, a resident registration number, an identification

number of a mobile terminal, etc), which is provided from the user accessing the

certification system through the WAP, to the mobile communication service

system to perform the primary certification, and then, transfers second information (for example, ID, a password, etc., which is granted on the Web for access to the

certification system), which is provided from the user, to a server to perform the

secondary certification on the Web. When it is determined that the user is an authorized person by the primary and secondary certifications, the certification system provides the history information on the Web to the user. Accordingly, the user is provided with, for example, a service of opening personal information such as mail, a general

contents service including payment methods, etc., through the WAP. Particularly,

in the embodiment of the present invention, if the user is required to make a

payment, the payment can be processed using a settlement account issued to the

user on the Web. The primary and secondary certifications performed in the certification

system, although classified for the sake of convenience of explanation in this embodiment, are intended not to be limited in sequence. That is, the secondary

certification may be performed after the primary certification is performed, and vice versa. Next, based on such a concept, structure and operation of the certification system through the network according to the embodiment of the present invention will be described in detail. FIG. 1 shows a structure of the certification system according to the embodiment of the present invention. Referring to FIG. 1, the certification system 100 according to the embodiment of the present invention is connected to a plurality of user terminals 300 and 400 through a network 200 (including various types of networks such as a telephone network, a wired Internet, a radio communication network, etc.). In addition, the certification system 100 is connected to a mobile communication system 600. In this case, a separate server of a security certification service provider, i.e., a certification gateway 500, may be connected between the certification system 100 and the mobile communication system 600. The user terminal 300 is a communication device accessible* to the certification system 100 through the network 200, including a wired terminal, a radio terminal, a computer, an Internet accessible TV, etc. Accordingly, users can access the certification system 100 conveniently and promptly using PC communication, a wired Internet, a telephone network, etc. Herein, for the sake of convenience of explanation, the wired terminal of the user is called a first terminal 300 and the radio terminal is called a second terminal 400. The certification system 100 connected to the terminals 300 a d 400 includes first and second access servers 10 and 20, first and second certification servers 30 and 40, a database server 50, and a settlement server 60. The first access server 10 performs an access process for the users accessing the certification system 100 through the wired Internet (the first network). The first access server 10 may be called a Web server. The second access server 20 performs an access process for the users accessing the certification system 100 through the radio Internet (the second network). The second access server 20 may be called a WAP server. The first certification server 30 performs a certification process for the users accessing the certification system 100 through the first access server 10. To this end, the first certification server 30 includes a membership database 31 in which information on members, that is, users to whom a service can be provided by the certification system 100, is stored, and a first certifying unit 32 for performing certification for the users accessing the certification system 100 through the first access server 10 based on the information stored in the membership database 31. Information (IDs, passwords, resident registration numbers, etc.) on users registered as members in the certification system 100 (registration users) can be stored in the membership database 31. The second certification server 40 performs a certification process for the users accessing the certification system 100 through the second access server 20. To this end, the second certification server 40 includes a second certifying unit 41 for performing certification for the users accessing the certification system 100 through the second access server 20, a first processor 42 for selectively granting temporary identification codes to the users, a second processor 43 for changing the temporary identification codes of the users to formal identification codes, and a certification user database 44 in which information on certified users is stored. The second certifying unit 41 performs certification in conjunction with the mobile communication system 600 based on radio telephone numbers of the radio terminals of the users and resident registration numbers of radio terminal subscribers, which are provided from the second access server 20. In addition, the second certifying unit 41 performs the first certification for the users accessing the certification system through the second access server 20 and then transfers additional information, which is provided from the users, to the first certification server 30 for performing the secondary certification for the user. On the other hand, information on the certified users is stored in the certification user database 44 , for example, the resident registration numbers as first identification information of the users (hereinafter abbreviated to resident numbers), the identification numbers of the radio terminals, which are matched with the resident numbers, etc. The identification numbers are the radio telephone numbers of the radio terminals, however they may be different identification numbers granted to the radio terminals. In addition, IDs of the users corresponding to the resident numbers and the identification numbers can be stored in the certification user database 44. In this case, the IDs may be formal IDs granted to the users when they join in membership or temporary IDs temporality granted to the user by the certification system 100. On the other hand, the database server 50 includes a first log database 51 in which the history information on the users accessing the certification system 100 through the first network is stored, and a second log database 52 in which the history information on the users accessing the certification system 100 through the second network is stored. The history information on the users is stored in the first and second log databases 51 and 52 for each user ID. Here, the history information is information on all activities performed by the users who have accessed the certification system 100, for example, transmitted/received information registered in a mail account, information on goods purchased, settlement information, etc. The settlement information may contain information on settlement accounts in which cyber money is accumulated, details of the cyber money accumulation, details of payments, etc. The settlement server 60 performs settlement for a charged service provided to the users who have accessed the certification system 100 through the first access server 10 or the second access server 20. Particularly, in this embodiment, the settlement server 60 performs settlement using a settlement account provided by the certification system 100 by request of the users. The settlement account may be granted for each user and may store cyber money and the like provided by the certification system 100. In the certification system, as constructed above, according to the embodiment of the present invention, the servers 10 to 60 are servers classified based on their functions and are changeable in various ways without limitation. For example, all of the databases may be contained in the database server 50, or the first and second certification servers 30 and 40 may be integrated into a single certification server. In addition, the first or second access server 10 or 20 may contain the first or second certification server 30 or 40 and the database server 50, or the first and second access server 10 and 20 may contain the first certification server 30 and the database server 50, respectively. In addition, the first or second certification server 30 or 40 may selectively contain the above-mentioned elements as needed, or the elements may be configured as separate servers for processing relevant functions. In addition, the databases 41 to 43 are not limited to the classification as described above. Next, based on the structure as constructed above, operation of the certification system according to embodiments of the present invention will be described. FIG. 2 illustrates an example of operation of each server in a certification process according to an embodiment of the present invention, and FIGs. 3A and 3B illustrate the certification method according to the embodiment, sequentially. First, it is assumed that a user who accesses the certification system 100 through the first network, that is, the Web, and then is registered as a member in the certification system 100, wishes to receive a service through the second network, that is, the WAP. In this case, as shown in FIG. 3A, the user drives a program (for example, a WAP browser or the like) for access to the radio Internet in the radio terminal 400 and then enters a URL (uniform resource location) for access to the certification system 100. This URL information is transmitted to the mobile communication service system 600 via the WAP gateway. Based on the URL information, the mobile communication service system 600 connects the radio terminal of the user to the certification system 100. When the connection is established between the certification system 100 and the radio terminal 400 of the user, the second access server 20 transmits a WAP page to the radio terminal 400 to allow the user to use the radio Internet (Steps S100 and S110). Thereafter, when a payment service is requested, the second access server 20 receives identification information, that is, the resident number, from the user to certify whether the user is an authorized person (Steps 120 to S140). That is, the second access server 20 requests the radio terminal 400 to input the resident number. Next, the second access server 20 acquires the identification number of the radio terminal of the user (Step S150) and then transmits the acquired identification number and the resident number to the second certification server 40, and requests the second certification server 40 to perform the certification for the user (Step S160). Generally, as communication between the radio terminal and the certification system is established based on the identification number of the radio terminal, the identification number and additional information inputted by the user are automatically contained in all messages transmitted from the radio terminal to the certification system. Accordingly, the second access server 20 can easily acquire the identification number from the messages provided from the radio terminal 400. This process is obvious to those skilled in the art, and therefore a detailed explanation thereof will be omitted for the purpose of brevity of description. The second certifying unit 32 of the second certification server 30 provides the received resident number and identification number to the mobile communication service system 600, and requests the system 600 to perform the certification for the user (Step S170). Based on the database in which the information on the users using radio communication of the mobile communication service system 600 is stored, the mobile communication service system 600 determines whether the resident number stored in correspondence to the received identification number is coincident with the resident number received from the second certification server 40, and then transmits a result of the determination to the second certification server 40 (Step S180). At this time, if the mobile communication service system 600 determines that the stored resident number is coincident with the resident number inputted by the user, to ensure reliability of the certification, that is, in order to ascertain whether the certified user is a real owner of the radio terminal, the first certifying unit 31 of the second certification server 30 transmits a certification message to the radio terminal having the identification number inputted by the user through the mobile communication service system 600 and requests the user to input the certification message transmitted to the radio terminal. In this case, an SMS (short message service) certification process for determining whether the user is the authorized person depending on whether the transmitted certification message is coincident with the inputted certification message is performed. The SMS certification process serves to prevent an unauthorized person from using the identification number of the radio terminal and the resident number of the authorized user by stealth. Such an SMS certification process may be optional. After performing such a certification process, the first processor 42 of the second certification server 40 grants a temporary ID to the user and then stores the inputted resident number and identification number in the certification user database 44 in correspondence to the temporary ID (Step S190 -S210). On the other hand, when a message of "not certified" is sent from the mobile communication service system 600 as it is determined in Step S190 that the inputted resident number is not coincident with the stored resident number, the second certifying unit 41 of the second certification server 40 informs the radio terminal 400 of the user of certification disallowance through the second access server 20 (Step S220). Next, as shown in FIG. 3B, although the primary certification is performed through the mobile communication service system as described above, in order to further improve security without directly providing a service to the user, the second certifying unit 41 of the second certification server 40 additionally requests the radio terminal 400 of the user to input the ID and password granted by the certification system 100 (Step S220). When the second certifying unit 41 receives the ID and password from the radio terminal 400 of the user, it transmits the received ID and password to the first certification server 30 for performing the certification on the Web and requests the certification server 30 to perform the certification for the user (Step 230 and S240). According to the request for the certification, based on the transmitted ID and password, the first certifying unit 32 of the first certification server 30 searches the membership database 31 to determine whether there is a coincident ID and password in the database 31, and then transmits a result of the determination to the second certifying unit 41 (Step S250). If it is determined that the ID and password inputted by the user are not present in the membership database 31 , the second certifying unit 41 of the second certification server 40 informs the user that a service is not allowed to be provided to him (Step S260 and S270). On the contrary, if it is determined that the ID and password inputted by the user are present in the membership database 31, the user is considered to be an authorized person, thereby providing a relevant service. Specifically, the second certifying unit 41 transmits the user ID to the second processor 42, and then the second processor 41 changes a temporary user ID stored in the certification user database 44 to the transmitted user ID and provides the transmitted user ID to the second access server 20 (Step S280). Accordingly, based on the ID provided from the second certification server 40, the second access server 20 finds the history information stored in the first and second log databases 51 and 52 and provides the found history information to the user (Step S290). More specifically, the second access server 20 provides the user ID to the first access server 10 and requests the first access server 10 to provide the history information. Then, when the history information stored in the first log database 51 in correspondence to the user ID is transmitted from the first access server 10 to the second access server 20, the second access server 20 provides the history information stored in the second log database 52 in correspondence to the user ID. In this manner, according to this embodiment of the present invention, since the settlement is performed using settlement account information on the Web after the primary and secondary certifications are performed, unauthorized users can be prevented from using a service on the WAP. On the other hand, in addition to the settlement using the settlement account, when the user requests a settlement using a radio telephone number, the second access server 20 provides the radio telephone number of the user and details of settlement to the mobile communication service system 600, requesting the system 600 to perform the settlement. Accordingly, a bill for the radio telephone number, along with a bill for the service provided through the WAP, may be issued in the future. In addition, in this embodiment, Step S200 where the primary certification is performed in conjunction with the mobile communication service system 600, the temporary ID is granted to the user, and then the temporary ID is stored in the certification user database 44, and Step S280 where the secondary certification is performed through the first access server 10 and then the temporary ID is changed to the user ID, may be optionally performed. On the other hand, in this embodiment, even when the user joins as a member in a plurality of web sites, history information at the web sites can be provided to the user accessing the certification system through the WAP. In this case, addresses of the web sites in which the user join as the member and IDs and passwords at the web sites are stored in the membership database 31 in correspondence to the user identification number (for example, the resident number), and history information on activities in the web sites is stored in the first log database 51 in correspondence to the IDs. FIG. 4A shows data stored in the membership database 31 and FIG. 4B shows data stored in the first log database 51. Unlike examples shown in FIGs. 4A and 4B, the first log database may be a plurality of separate databases in which the history information is stored for each web site. FIG. 5 illustrates a certification process according to another embodiment of the present invention. Referring to FIG. 5, when the user who joins as the member in the plurality of web sites accesses the certification system through the WAP and requests the system to provide a service of linking the history information on the Web, the second access server 20 performs the primary certification using the identification number of the radio terminal and the resident number of the user and receives the user ID and password from the user for additionally performing certification in conjunction with the first access server 10 (Steps S400 to S430), as described above. When the user requests the history information on the Web after the certification for the user is performed, the second access server 20 transmits the user ID to the first access server 10 and requests the server 10 to provide the history information (Step S440). Based on the transmitted user ID, the first access server 10 searches the membership database 31 to confirm an address of a web site in which the ID and password are registered (Step S450), searches the first log database 31 based on the web site address to read out the history information which corresponds to the ID of various history information corresponding to the web site address, and then transmits the read history information to the second access server 20 (Step S460 and S470). Accordingly, the second access server 20 provides the transmitted history information to the radio terminal 400 of the user (Step S480). On the other hand, if the user uses the same ID in two or more web sites, the first access server 10 provides addresses of web sites corresponding to the ID, which is inputted by the user, to the radio terminal 400 of the user through the second access server 20 to allow the user to select a desired web site desired (Step S490 and S500). In this case, the user may request the history information of all web sites corresponding to the ID or may select one or more web sites (Step S510). When an identification number of the web site selected by the user through the second access server 20 is provided to the first access server 10, the first access server 10 transmits the history information which corresponds to the web site from the first log database 51 to the second access server 20, which in turn provides the history information to the user (Step S510 to S540). According to this embodiment, even when the user joins as a member in the plurality of web sites, he can easily receive the history information by accessing the certification system through the WAP. On the other hand, in the above-described embodiments, when information on the user for whom the primary and secondary certifications are completed is stored in the certification user database, a service can be provided to the user without performing the certification process when the user accesses the certification system through the WAP. The certification processes according to the above-described embodiments can be implemented in the form of a program stored in a recording medium such as a hard disk, a CD-ROM, a floppy disk, and the like. Although the preferable embodiments of the present invention have been illustrated so far, it should be understood that modifications, changes, and alterations to the embodiments are possible without deviating from the spirit and scope of the invention. For example, while the resident number is used as the first identification information of the user and the ID is used as the second identification information in the preferable embodiments, other numbers or information may be also used as the first or second identification information. Therefore, the scope of the present invention should not be defined by the above embodiments, but by the attached claims and equivalents to the claims. As is apparent from the above description, according to the present invention reliable certification for users accessing a system through a radio network can be performed, which results in a safe service. Particularly, in addition to the certification using a telephone number of a radio terminal, by additionally performing the certification using user identification information (ID, passwords, and the like) granted on the Web, an unauthorized person can be effectively prevented from requesting a service using the radio terminal of the user.

Claims

WHAT IS CLAIMED IS:

1 . A certification system connected to a mobile communication service

system via a network, the certification system including a first access server for

performing an access process for a user accessing the certification system

through the first network and a first certification server for performing certification

for the user accessing the certification system through the first network, the

certification system performing certification for the user accessing the certification system through the second network, comprising a second access server for performing certification for the user

accessing the certification system through a second network, and a second certification server for performing certification for the user accessing the certification system through the second network, wherein the second certification server includes a first certifying unit for acquiring first identification information and an

identification number of a radio terminal of the user from the radio terminal of the

user accessing the certification system through the second network and transmitting the first identification information and the identification number to the

mobile communication service system to perform primary certification; a first processor for granting a temporary identification code to the user after the primary certification is performed and storing the first identification information in correspondence to the temporary identification code; a second certifying unit for acquiring second identification information from the radio terminal of the user and transmitting the second identification information to the first certification server to perform secondary certification; and a second processor for changing the temporary identification code of the user to specific information contained in the second identification information and providing the second identification information to the second access server when the secondary certification is being performed, and wherein the second access server selectively provides information requested by the radio terminal of the user to the radio terminal of the user based on the second identification information of the user provided from the second certification server in conjunction with the first access server.

2. The certification system of Claim 1, wherein the first certification server includes a membership database in which the second identification information of the user is stored, and wherein the first certifying includes user certification according to a request from the first access server or the second access server based on information stored in the membership database.

3. The certification system of Claim 1, wherein the first identification information is a resident registration number, and the second identification information is an ID and password registered in the certification system by the user.

4. The certification system of Claim 1 , further comprising: a first log database in which history information on activities performed

by the user who has accessed the certification system through the first network is

stored in correspondence to the second identification information; and a second log database in which history information on activities performed by the user who has accessed the certification system through the

second network is stored in correspondence to the second identification

information, wherein the second access server provides the history information of the

user stored in the first log database and the second log database to the radio

terminal of the user according to a request from the certified user.

5. The certification system of Claim 2 or 4, wherein the second

identification information of the user and an identification number of a web site in which the second identification is registered are correspondingly stored in the

membership database, and wherein the history information is stored in the first log database in correspondence to the second identification information for each web site.

6. The certification system of Claim 1 , wherein the history information stored in the first log database contains information on a settlement account in which cyber money is charged, further comprising: a settlement server for performing settlement for a paid service using the cyber money charged in the settlement account if a service provided to the user through the second access server is the paid service.

7. A certification method of a certification system connected to a mobile communication service system through a network for performing certification for a user accessing the certification system through first and second networks, the method comprising: a) receiving first identification information of the user and an identification number of a radio terminal of the user from the user accessing the certification system through the second network and requesting a service; b) transmitting the first identification information and the identification number of the radio terminal to the mobile communication service system and requesting the mobile communication service system to perform primary certification for the user; c) receiving second identification information from the user and performing secondary certification for the user; and d) providing a service requested by the user to the radio terminal of the

user who has accessed the certification system through the second network after the primary and secondary certifications are performed.

8. The certification method of Claim 7, wherein the step c) includes performing certification for the user accessing the certification system through the first network based on the second identification information.

9. The certification method of Claim 7, wherein the step d) includes providing history information on activities performed by the user who accessed the certification system through the first network or history information on activities performed by the user who accessed the certification system through the second network to the radio terminal of the user.

10. The certification method of Claim 7, wherein the step b) further includes granting a temporary identification number to the user when the mobile communication service system informs the certification system of a result of the certification for the user, and storing the temporary identification number in a certification user database in correspondence to the first identification information and the identification number of the radio terminal, wherein the step c) further includes changing the temporary identification number of the user stored in the certification user database to the second identification information after the secondary certification is performed based on the second identification information, and wherein the step d) includes providing specific information to the user based on the second identification information.

11. The certification method of Claim 7, wherein the first network is a wired Internet and the second network is a radio Internet.